Azure Alert - Updated query not being used

Rob 61

Hi,

I have a simple heartbeat alert configured within OMS that uses the following log query

Heartbeat
| summarize LastHeartbeat=max(TimeGenerated) by Computer
| where LastHeartbeat < ago(5m)

This worked great, if a server missed a heartbeat I'd get an email alerting me. One of the servers is on a very slow broadband connection so I was getting false alerts so I tweaked the query to 10 minutes. This was done over 48 hours ago but I am still getting alerts that show the original query. I've tried disabling/enabling the rule but the problem persists. The next step will be to delete and re-create but before I did that I just wanted to check I've not missed something?

olufemia-MSFT 2,861 Reputation points

2020-06-25T14:04:38.227+00:00

Hello RobC-CTL , sorry for the delay. disabling + enabling should have worked. Please don't hesitate to reply if this remains an issue and we can help investigate further or connect you to our technical support channel.

CHeers.
Rob 61 Reputation points

2020-06-26T09:21:57.987+00:00

Hi @olufemiaMSFT thanks for the reply. Since posting this I've deleted the and recreated it with a new name but I am still getting alerts being triggered by the old (now deleted) rule, very odd?

Cheers
Rob
Rob 61 Reputation points

2020-07-03T16:47:35.363+00:00

cc @olufemiaMSFT

This is getting daft now, I am getting emails every 20 minutes from a action rule that has long since been deleted. If I click on the alert from the portal it shows the alert id and a URL to the alert rule as seen here

If I click on the URL I just get taken to a error screen

I've tried using CLI to find the rule but I can't find any reference to it - very confusing.

Any help gratefully received!

Cheers
Rob
HUNTER, ROBERT 36 Reputation points

2020-07-03T17:12:15.407+00:00

did you check resource group name, documentation reference to remove AlertRule

https://learn.microsoft.com/en-us/powershell/module/azurerm.insights/remove-azurermalertrule?view=azurermps-6.13.0

@olufemiaMSFT
@RobC-CTL
olufemia-MSFT 2,861 Reputation points

2020-07-03T22:15:29.737+00:00

@RobC-CTL - sincere apologies for the inconsistent response. At this point, I would like to see what you are seeing so we can resolve this asap. do you mind connecting via email?

If yes, send mail to AzCommunity@microsoft.com including "Attn:femi" in subject line.
Also add your Azure subscription ID and a link to this Post (for context).

Looking forward to your response.

Have a nice weekend.

Accepted answer

olufemia-MSFT 2,861 Reputation points

2020-07-24T09:22:16.837+00:00

Hello @RobC-CTL - as discussed offline, Your issue has been linked to a known product bug that typically occurs when an alert is created and deleted almost immediately. Good news is there's already a fix in the works Will share more updates on the fix timelines once I hear back from the feature team. If the issue persists, raise a support request directly with our support channel or reach out to the previously shared email address.

Cheers.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Share via

Azure Alert - Updated query not being used

0 additional answers